suppressing adjacent events with duplicate field values

[Justin_Grant]

I have a log which often has redundant events, where "redundant" is defined as 2+ events, on subsequent lines, where each redundant event has the same value for a particular field (e.g. "ID").

How can I suppress the second and subsequent events so only the first event in a set shows up in my search results?

[gkanapathy · Accepted solution]

You can pipe the events through | dedup consecutive=true fieldname

sourcetype=mydupeylog | dedup consecutive=true mydupeyfield

[Justin_Grant]

Cool! BTW, the docs for the dedup command are here: http://www.splunk.com/base/Documentation/latest/SearchReference/Dedup